Join Us!

Last Activation Tim...
 
Notifications
Clear all

Last Activation Time property from iPhone's UFED Extraction  

  RSS
Skywalker
(@skywalker)
Active Member

Hello everybody and happy new year.

I would like to ask what does 'Last Activation Time' property, from un iPhone's Advanced Logical Extraction using UFED Physical Analyzer mean?

I thin, but maybe I'm wrong, it means the last time the device was set to the factory default, isn't it?

Thanks and regards!

Quote
Posted : 04/01/2017 12:16 am
Skywalker
(@skywalker)
Active Member

Anyway, if 'Last Activation Time' doesn't mean the last time the phone was set to the factory default, which property in an UFED report is the one which means the time the phone was set to the factory default?

I'm starting to suspect that 'Last Activation Time' means the last time the owner set on the phone, but I cannot find the property which means the time the phone was set to factory default.

Thanks!

ReplyQuote
Posted : 04/01/2017 12:49 am
vootz
(@vootz)
Junior Member

Skywalker,

If you google "Blackbag tech iphone wiped" - Blackbag Technologies has a blog post about the artifacts to look for indications an iPhone was factory reset (in a nutshell, look for a zero-byte .obliterated file in the data/root path); there will be a date/time stamp on that, and it might not always still exist.

Thanks

ReplyQuote
Posted : 04/01/2017 1:02 am
Skywalker
(@skywalker)
Active Member

Skywalker,

If you google "Blackbag tech iphone wiped" - Blackbag Technologies has a blog post about the artifacts to look for indications an iPhone was factory reset (in a nutshell, look for a zero-byte .obliterated file in the data/root path); there will be a date/time stamp on that, and it might not always still exist.

Thanks

Could it be possible to find it in an UFED's Advanced Logical Extraction?

ReplyQuote
Posted : 05/01/2017 5:53 am
Share: